Contents of /trunk/kernel26-magellan-server/patches-2.6.25-r4/0100-2.6.25.1-all-fixes.patch
Parent Directory | Revision Log
Revision 665 -
(show annotations)
(download)
Wed Jul 30 14:06:06 2008 UTC (16 years, 2 months ago) by niro
File size: 36826 byte(s)
Wed Jul 30 14:06:06 2008 UTC (16 years, 2 months ago) by niro
File size: 36826 byte(s)
-2.6.25-magellan-r4; updated to linux-2.6.25.10
1 | diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c |
2 | index 8c71daf..9fee37e 100644 |
3 | --- a/arch/alpha/kernel/osf_sys.c |
4 | +++ b/arch/alpha/kernel/osf_sys.c |
5 | @@ -75,6 +75,7 @@ osf_set_program_attributes(unsigned long text_start, unsigned long text_len, |
6 | lock_kernel(); |
7 | mm = current->mm; |
8 | mm->end_code = bss_start + bss_len; |
9 | + mm->start_brk = bss_start + bss_len; |
10 | mm->brk = bss_start + bss_len; |
11 | #if 0 |
12 | printk("set_program_attributes(%lx %lx %lx %lx)\n", |
13 | diff --git a/arch/x86/kernel/io_apic_32.c b/arch/x86/kernel/io_apic_32.c |
14 | index 4ca5486..f239b30 100644 |
15 | --- a/arch/x86/kernel/io_apic_32.c |
16 | +++ b/arch/x86/kernel/io_apic_32.c |
17 | @@ -2477,6 +2477,7 @@ void destroy_irq(unsigned int irq) |
18 | dynamic_irq_cleanup(irq); |
19 | |
20 | spin_lock_irqsave(&vector_lock, flags); |
21 | + clear_bit(irq_vector[irq], used_vectors); |
22 | irq_vector[irq] = 0; |
23 | spin_unlock_irqrestore(&vector_lock, flags); |
24 | } |
25 | diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c |
26 | index a871586..579745c 100644 |
27 | --- a/arch/x86/pci/irq.c |
28 | +++ b/arch/x86/pci/irq.c |
29 | @@ -200,7 +200,7 @@ static int pirq_ali_get(struct pci_dev *router, struct pci_dev *dev, int pirq) |
30 | { |
31 | static const unsigned char irqmap[16] = { 0, 9, 3, 10, 4, 5, 7, 6, 1, 11, 0, 12, 0, 14, 0, 15 }; |
32 | |
33 | - WARN_ON_ONCE(pirq >= 16); |
34 | + WARN_ON_ONCE(pirq > 16); |
35 | return irqmap[read_config_nybble(router, 0x48, pirq-1)]; |
36 | } |
37 | |
38 | @@ -209,7 +209,7 @@ static int pirq_ali_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i |
39 | static const unsigned char irqmap[16] = { 0, 8, 0, 2, 4, 5, 7, 6, 0, 1, 3, 9, 11, 0, 13, 15 }; |
40 | unsigned int val = irqmap[irq]; |
41 | |
42 | - WARN_ON_ONCE(pirq >= 16); |
43 | + WARN_ON_ONCE(pirq > 16); |
44 | if (val) { |
45 | write_config_nybble(router, 0x48, pirq-1, val); |
46 | return 1; |
47 | @@ -260,7 +260,7 @@ static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq |
48 | { |
49 | static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; |
50 | |
51 | - WARN_ON_ONCE(pirq >= 5); |
52 | + WARN_ON_ONCE(pirq > 5); |
53 | return read_config_nybble(router, 0x55, pirqmap[pirq-1]); |
54 | } |
55 | |
56 | @@ -268,7 +268,7 @@ static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq |
57 | { |
58 | static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; |
59 | |
60 | - WARN_ON_ONCE(pirq >= 5); |
61 | + WARN_ON_ONCE(pirq > 5); |
62 | write_config_nybble(router, 0x55, pirqmap[pirq-1], irq); |
63 | return 1; |
64 | } |
65 | @@ -282,7 +282,7 @@ static int pirq_ite_get(struct pci_dev *router, struct pci_dev *dev, int pirq) |
66 | { |
67 | static const unsigned char pirqmap[4] = { 1, 0, 2, 3 }; |
68 | |
69 | - WARN_ON_ONCE(pirq >= 4); |
70 | + WARN_ON_ONCE(pirq > 4); |
71 | return read_config_nybble(router,0x43, pirqmap[pirq-1]); |
72 | } |
73 | |
74 | @@ -290,7 +290,7 @@ static int pirq_ite_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i |
75 | { |
76 | static const unsigned char pirqmap[4] = { 1, 0, 2, 3 }; |
77 | |
78 | - WARN_ON_ONCE(pirq >= 4); |
79 | + WARN_ON_ONCE(pirq > 4); |
80 | write_config_nybble(router, 0x43, pirqmap[pirq-1], irq); |
81 | return 1; |
82 | } |
83 | diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c |
84 | index b2112f5..a3b2374 100644 |
85 | --- a/drivers/infiniband/hw/nes/nes.c |
86 | +++ b/drivers/infiniband/hw/nes/nes.c |
87 | @@ -751,13 +751,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev) |
88 | |
89 | list_del(&nesdev->list); |
90 | nes_destroy_cqp(nesdev); |
91 | + |
92 | + free_irq(pcidev->irq, nesdev); |
93 | tasklet_kill(&nesdev->dpc_tasklet); |
94 | |
95 | /* Deallocate the Adapter Structure */ |
96 | nes_destroy_adapter(nesdev->nesadapter); |
97 | |
98 | - free_irq(pcidev->irq, nesdev); |
99 | - |
100 | if (nesdev->msi_enabled) { |
101 | pci_disable_msi(pcidev); |
102 | } |
103 | diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c |
104 | index 0bef878..96b1a0e 100644 |
105 | --- a/drivers/infiniband/hw/nes/nes_cm.c |
106 | +++ b/drivers/infiniband/hw/nes/nes_cm.c |
107 | @@ -1834,8 +1834,10 @@ int mini_cm_recv_pkt(struct nes_cm_core *cm_core, struct nes_vnic *nesvnic, |
108 | nfo.rem_addr = ntohl(iph->saddr); |
109 | nfo.rem_port = ntohs(tcph->source); |
110 | |
111 | - nes_debug(NES_DBG_CM, "Received packet: dest=0x%08X:0x%04X src=0x%08X:0x%04X\n", |
112 | - iph->daddr, tcph->dest, iph->saddr, tcph->source); |
113 | + nes_debug(NES_DBG_CM, "Received packet: dest=" NIPQUAD_FMT |
114 | + ":0x%04X src=" NIPQUAD_FMT ":0x%04X\n", |
115 | + NIPQUAD(iph->daddr), tcph->dest, |
116 | + NIPQUAD(iph->saddr), tcph->source); |
117 | |
118 | /* note: this call is going to increment cm_node ref count */ |
119 | cm_node = find_node(cm_core, |
120 | diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c |
121 | index 49e53e4..496655e 100644 |
122 | --- a/drivers/infiniband/hw/nes/nes_hw.c |
123 | +++ b/drivers/infiniband/hw/nes/nes_hw.c |
124 | @@ -625,6 +625,15 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode) |
125 | nes_debug(NES_DBG_INIT, "Did not see full soft reset done.\n"); |
126 | return 0; |
127 | } |
128 | + |
129 | + i = 0; |
130 | + while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000) |
131 | + mdelay(1); |
132 | + if (i >= 10000) { |
133 | + printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n", |
134 | + nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS)); |
135 | + return 0; |
136 | + } |
137 | } |
138 | |
139 | /* port reset */ |
140 | @@ -673,17 +682,6 @@ unsigned int nes_reset_adapter_ne020(struct nes_device *nesdev, u8 *OneG_Mode) |
141 | } |
142 | } |
143 | |
144 | - |
145 | - |
146 | - i = 0; |
147 | - while ((nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS) != 0x80) && i++ < 10000) |
148 | - mdelay(1); |
149 | - if (i >= 10000) { |
150 | - printk(KERN_ERR PFX "Internal CPU not ready, status = %02X\n", |
151 | - nes_read_indexed(nesdev, NES_IDX_INT_CPU_STATUS)); |
152 | - return 0; |
153 | - } |
154 | - |
155 | return port_count; |
156 | } |
157 | |
158 | diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c |
159 | index 5bbce29..c7d305b 100644 |
160 | --- a/drivers/md/dm-exception-store.c |
161 | +++ b/drivers/md/dm-exception-store.c |
162 | @@ -131,7 +131,7 @@ struct pstore { |
163 | |
164 | static unsigned sectors_to_pages(unsigned sectors) |
165 | { |
166 | - return sectors / (PAGE_SIZE >> 9); |
167 | + return DIV_ROUND_UP(sectors, PAGE_SIZE >> 9); |
168 | } |
169 | |
170 | static int alloc_area(struct pstore *ps) |
171 | diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c |
172 | index 8c9a8ad..8bf5596 100644 |
173 | --- a/drivers/media/video/cx88/cx88-cards.c |
174 | +++ b/drivers/media/video/cx88/cx88-cards.c |
175 | @@ -1354,6 +1354,10 @@ static const struct cx88_board cx88_boards[] = { |
176 | }}, |
177 | /* fixme: Add radio support */ |
178 | .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD, |
179 | + .radio = { |
180 | + .type = CX88_RADIO, |
181 | + .gpio0 = 0xe780, |
182 | + }, |
183 | }, |
184 | [CX88_BOARD_ADSTECH_PTV_390] = { |
185 | .name = "ADS Tech Instant Video PCI", |
186 | diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c |
187 | index edef2a5..1e6f36e 100644 |
188 | --- a/drivers/media/video/ivtv/ivtv-ioctl.c |
189 | +++ b/drivers/media/video/ivtv/ivtv-ioctl.c |
190 | @@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, struct file *filp, unsigned int cmd, void |
191 | |
192 | memset(vcap, 0, sizeof(*vcap)); |
193 | strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */ |
194 | - strcpy(vcap->card, itv->card_name); /* card type */ |
195 | + strncpy(vcap->card, itv->card_name, |
196 | + sizeof(vcap->card)-1); /* card type */ |
197 | strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */ |
198 | vcap->version = IVTV_DRIVER_VERSION; /* version */ |
199 | vcap->capabilities = itv->v4l2_cap; /* capabilities */ |
200 | diff --git a/drivers/media/video/tea5761.c b/drivers/media/video/tea5761.c |
201 | index 5326eec..de7e060 100644 |
202 | --- a/drivers/media/video/tea5761.c |
203 | +++ b/drivers/media/video/tea5761.c |
204 | @@ -249,14 +249,19 @@ int tea5761_autodetection(struct i2c_adapter* i2c_adap, u8 i2c_addr) |
205 | |
206 | if (16 != (rc = tuner_i2c_xfer_recv(&i2c, buffer, 16))) { |
207 | printk(KERN_WARNING "it is not a TEA5761. Received %i chars.\n", rc); |
208 | - return EINVAL; |
209 | + return -EINVAL; |
210 | } |
211 | |
212 | - if (!((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061))) { |
213 | - printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x. It is not a TEA5761\n",buffer[13],buffer[14],buffer[15]); |
214 | - return EINVAL; |
215 | + if ((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061)) { |
216 | + printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x." |
217 | + " It is not a TEA5761\n", |
218 | + buffer[13], buffer[14], buffer[15]); |
219 | + return -EINVAL; |
220 | } |
221 | - printk(KERN_WARNING "TEA5761 detected.\n"); |
222 | + printk(KERN_WARNING "tea5761: TEA%02x%02x detected. " |
223 | + "Manufacturer ID= 0x%02x\n", |
224 | + buffer[14], buffer[15], buffer[13]); |
225 | + |
226 | return 0; |
227 | } |
228 | |
229 | diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c |
230 | index 78a09a2..8cdbdd0 100644 |
231 | --- a/drivers/media/video/tuner-core.c |
232 | +++ b/drivers/media/video/tuner-core.c |
233 | @@ -1112,8 +1112,8 @@ static int tuner_probe(struct i2c_client *client) |
234 | if (!no_autodetect) { |
235 | switch (client->addr) { |
236 | case 0x10: |
237 | - if (tea5761_autodetection(t->i2c->adapter, t->i2c->addr) |
238 | - != EINVAL) { |
239 | + if (tea5761_autodetection(t->i2c->adapter, |
240 | + t->i2c->addr) >= 0) { |
241 | t->type = TUNER_TEA5761; |
242 | t->mode_mask = T_RADIO; |
243 | t->mode = T_STANDBY; |
244 | @@ -1125,7 +1125,7 @@ static int tuner_probe(struct i2c_client *client) |
245 | |
246 | goto register_client; |
247 | } |
248 | - break; |
249 | + return -ENODEV; |
250 | case 0x42: |
251 | case 0x43: |
252 | case 0x4a: |
253 | diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c |
254 | index c082cf0..de11039 100644 |
255 | --- a/drivers/net/s2io.c |
256 | +++ b/drivers/net/s2io.c |
257 | @@ -84,7 +84,7 @@ |
258 | #include "s2io.h" |
259 | #include "s2io-regs.h" |
260 | |
261 | -#define DRV_VERSION "2.0.26.20" |
262 | +#define DRV_VERSION "2.0.26.22" |
263 | |
264 | /* S2io Driver name & version. */ |
265 | static char s2io_driver_name[] = "Neterion"; |
266 | @@ -2339,7 +2339,7 @@ static void free_tx_buffers(struct s2io_nic *nic) |
267 | for (i = 0; i < config->tx_fifo_num; i++) { |
268 | unsigned long flags; |
269 | spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags); |
270 | - for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) { |
271 | + for (j = 0; j < config->tx_cfg[i].fifo_len; j++) { |
272 | txdp = (struct TxD *) \ |
273 | mac_control->fifos[i].list_info[j].list_virt_addr; |
274 | skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j); |
275 | diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c |
276 | index 17585e5..432e837 100644 |
277 | --- a/drivers/net/tehuti.c |
278 | +++ b/drivers/net/tehuti.c |
279 | @@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void) |
280 | s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]); |
281 | } |
282 | |
283 | +static int bdx_range_check(struct bdx_priv *priv, u32 offset) |
284 | +{ |
285 | + return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ? |
286 | + -EINVAL : 0; |
287 | +} |
288 | + |
289 | static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) |
290 | { |
291 | struct bdx_priv *priv = ndev->priv; |
292 | @@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) |
293 | DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]); |
294 | } |
295 | |
296 | + if (!capable(CAP_SYS_RAWIO)) |
297 | + return -EPERM; |
298 | + |
299 | switch (data[0]) { |
300 | |
301 | case BDX_OP_READ: |
302 | + error = bdx_range_check(priv, data[1]); |
303 | + if (error < 0) |
304 | + return error; |
305 | data[2] = READ_REG(priv, data[1]); |
306 | DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2], |
307 | data[2]); |
308 | @@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) |
309 | break; |
310 | |
311 | case BDX_OP_WRITE: |
312 | + error = bdx_range_check(priv, data[1]); |
313 | + if (error < 0) |
314 | + return error; |
315 | WRITE_REG(priv, data[1], data[2]); |
316 | DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]); |
317 | break; |
318 | diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c |
319 | index 96043c5..bc4c62b 100644 |
320 | --- a/drivers/net/tg3.c |
321 | +++ b/drivers/net/tg3.c |
322 | @@ -64,8 +64,8 @@ |
323 | |
324 | #define DRV_MODULE_NAME "tg3" |
325 | #define PFX DRV_MODULE_NAME ": " |
326 | -#define DRV_MODULE_VERSION "3.90" |
327 | -#define DRV_MODULE_RELDATE "April 12, 2008" |
328 | +#define DRV_MODULE_VERSION "3.91" |
329 | +#define DRV_MODULE_RELDATE "April 18, 2008" |
330 | |
331 | #define TG3_DEF_MAC_MODE 0 |
332 | #define TG3_DEF_RX_MODE 0 |
333 | @@ -4135,11 +4135,21 @@ static int tigon3_dma_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb, |
334 | u32 last_plus_one, u32 *start, |
335 | u32 base_flags, u32 mss) |
336 | { |
337 | - struct sk_buff *new_skb = skb_copy(skb, GFP_ATOMIC); |
338 | + struct sk_buff *new_skb; |
339 | dma_addr_t new_addr = 0; |
340 | u32 entry = *start; |
341 | int i, ret = 0; |
342 | |
343 | + if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701) |
344 | + new_skb = skb_copy(skb, GFP_ATOMIC); |
345 | + else { |
346 | + int more_headroom = 4 - ((unsigned long)skb->data & 3); |
347 | + |
348 | + new_skb = skb_copy_expand(skb, |
349 | + skb_headroom(skb) + more_headroom, |
350 | + skb_tailroom(skb), GFP_ATOMIC); |
351 | + } |
352 | + |
353 | if (!new_skb) { |
354 | ret = -1; |
355 | } else { |
356 | @@ -4462,7 +4472,9 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev) |
357 | |
358 | would_hit_hwbug = 0; |
359 | |
360 | - if (tg3_4g_overflow_test(mapping, len)) |
361 | + if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG) |
362 | + would_hit_hwbug = 1; |
363 | + else if (tg3_4g_overflow_test(mapping, len)) |
364 | would_hit_hwbug = 1; |
365 | |
366 | tg3_set_txd(tp, entry, mapping, len, base_flags, |
367 | @@ -11339,6 +11351,38 @@ static int __devinit tg3_get_invariants(struct tg3 *tp) |
368 | } |
369 | } |
370 | |
371 | + if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) { |
372 | + static struct tg3_dev_id { |
373 | + u32 vendor; |
374 | + u32 device; |
375 | + } bridge_chipsets[] = { |
376 | + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_0 }, |
377 | + { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PXH_1 }, |
378 | + { }, |
379 | + }; |
380 | + struct tg3_dev_id *pci_id = &bridge_chipsets[0]; |
381 | + struct pci_dev *bridge = NULL; |
382 | + |
383 | + while (pci_id->vendor != 0) { |
384 | + bridge = pci_get_device(pci_id->vendor, |
385 | + pci_id->device, |
386 | + bridge); |
387 | + if (!bridge) { |
388 | + pci_id++; |
389 | + continue; |
390 | + } |
391 | + if (bridge->subordinate && |
392 | + (bridge->subordinate->number <= |
393 | + tp->pdev->bus->number) && |
394 | + (bridge->subordinate->subordinate >= |
395 | + tp->pdev->bus->number)) { |
396 | + tp->tg3_flags3 |= TG3_FLG3_5701_DMA_BUG; |
397 | + pci_dev_put(bridge); |
398 | + break; |
399 | + } |
400 | + } |
401 | + } |
402 | + |
403 | /* The EPB bridge inside 5714, 5715, and 5780 cannot support |
404 | * DMA addresses > 40-bit. This bridge may have other additional |
405 | * 57xx devices behind it in some 4-port NIC designs for example. |
406 | diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h |
407 | index c1075a7..c688c3a 100644 |
408 | --- a/drivers/net/tg3.h |
409 | +++ b/drivers/net/tg3.h |
410 | @@ -2476,6 +2476,7 @@ struct tg3 { |
411 | #define TG3_FLG3_NO_NVRAM_ADDR_TRANS 0x00000001 |
412 | #define TG3_FLG3_ENABLE_APE 0x00000002 |
413 | #define TG3_FLG3_5761_5784_AX_FIXES 0x00000004 |
414 | +#define TG3_FLG3_5701_DMA_BUG 0x00000008 |
415 | |
416 | struct timer_list timer; |
417 | u16 timer_counter; |
418 | diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c |
419 | index 48e9124..4ec1915 100644 |
420 | --- a/drivers/net/wireless/b43/dma.c |
421 | +++ b/drivers/net/wireless/b43/dma.c |
422 | @@ -822,6 +822,18 @@ static u64 supported_dma_mask(struct b43_wldev *dev) |
423 | return DMA_30BIT_MASK; |
424 | } |
425 | |
426 | +static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask) |
427 | +{ |
428 | + if (dmamask == DMA_30BIT_MASK) |
429 | + return B43_DMA_30BIT; |
430 | + if (dmamask == DMA_32BIT_MASK) |
431 | + return B43_DMA_32BIT; |
432 | + if (dmamask == DMA_64BIT_MASK) |
433 | + return B43_DMA_64BIT; |
434 | + B43_WARN_ON(1); |
435 | + return B43_DMA_30BIT; |
436 | +} |
437 | + |
438 | /* Main initialization function. */ |
439 | static |
440 | struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, |
441 | @@ -982,6 +994,42 @@ void b43_dma_free(struct b43_wldev *dev) |
442 | dma->tx_ring0 = NULL; |
443 | } |
444 | |
445 | +static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask) |
446 | +{ |
447 | + u64 orig_mask = mask; |
448 | + bool fallback = 0; |
449 | + int err; |
450 | + |
451 | + /* Try to set the DMA mask. If it fails, try falling back to a |
452 | + * lower mask, as we can always also support a lower one. */ |
453 | + while (1) { |
454 | + err = ssb_dma_set_mask(dev->dev, mask); |
455 | + if (!err) |
456 | + break; |
457 | + if (mask == DMA_64BIT_MASK) { |
458 | + mask = DMA_32BIT_MASK; |
459 | + fallback = 1; |
460 | + continue; |
461 | + } |
462 | + if (mask == DMA_32BIT_MASK) { |
463 | + mask = DMA_30BIT_MASK; |
464 | + fallback = 1; |
465 | + continue; |
466 | + } |
467 | + b43err(dev->wl, "The machine/kernel does not support " |
468 | + "the required %u-bit DMA mask\n", |
469 | + (unsigned int)dma_mask_to_engine_type(orig_mask)); |
470 | + return -EOPNOTSUPP; |
471 | + } |
472 | + if (fallback) { |
473 | + b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n", |
474 | + (unsigned int)dma_mask_to_engine_type(orig_mask), |
475 | + (unsigned int)dma_mask_to_engine_type(mask)); |
476 | + } |
477 | + |
478 | + return 0; |
479 | +} |
480 | + |
481 | int b43_dma_init(struct b43_wldev *dev) |
482 | { |
483 | struct b43_dma *dma = &dev->dma; |
484 | @@ -991,27 +1039,10 @@ int b43_dma_init(struct b43_wldev *dev) |
485 | enum b43_dmatype type; |
486 | |
487 | dmamask = supported_dma_mask(dev); |
488 | - switch (dmamask) { |
489 | - default: |
490 | - B43_WARN_ON(1); |
491 | - case DMA_30BIT_MASK: |
492 | - type = B43_DMA_30BIT; |
493 | - break; |
494 | - case DMA_32BIT_MASK: |
495 | - type = B43_DMA_32BIT; |
496 | - break; |
497 | - case DMA_64BIT_MASK: |
498 | - type = B43_DMA_64BIT; |
499 | - break; |
500 | - } |
501 | - err = ssb_dma_set_mask(dev->dev, dmamask); |
502 | - if (err) { |
503 | - b43err(dev->wl, "The machine/kernel does not support " |
504 | - "the required DMA mask (0x%08X%08X)\n", |
505 | - (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32), |
506 | - (unsigned int)(dmamask & 0x00000000FFFFFFFFULL)); |
507 | - return -EOPNOTSUPP; |
508 | - } |
509 | + type = dma_mask_to_engine_type(dmamask); |
510 | + err = b43_dma_set_mask(dev, dmamask); |
511 | + if (err) |
512 | + return err; |
513 | |
514 | err = -ENOMEM; |
515 | /* setup TX DMA channels. */ |
516 | diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c |
517 | index c73a75b..f23317e 100644 |
518 | --- a/drivers/net/wireless/b43/main.c |
519 | +++ b/drivers/net/wireless/b43/main.c |
520 | @@ -78,6 +78,11 @@ static int modparam_nohwcrypt; |
521 | module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444); |
522 | MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption."); |
523 | |
524 | +static int modparam_btcoex = 1; |
525 | +module_param_named(btcoex, modparam_btcoex, int, 0444); |
526 | +MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)"); |
527 | + |
528 | + |
529 | static const struct ssb_device_id b43_ssb_tbl[] = { |
530 | SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5), |
531 | SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6), |
532 | @@ -3339,6 +3344,8 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev) |
533 | struct ssb_sprom *sprom = &dev->dev->bus->sprom; |
534 | u32 hf; |
535 | |
536 | + if (!modparam_btcoex) |
537 | + return; |
538 | if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST)) |
539 | return; |
540 | if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode) |
541 | @@ -3350,11 +3357,13 @@ static void b43_bluetooth_coext_enable(struct b43_wldev *dev) |
542 | else |
543 | hf |= B43_HF_BTCOEX; |
544 | b43_hf_write(dev, hf); |
545 | - //TODO |
546 | } |
547 | |
548 | static void b43_bluetooth_coext_disable(struct b43_wldev *dev) |
549 | -{ //TODO |
550 | +{ |
551 | + if (!modparam_btcoex) |
552 | + return; |
553 | + //TODO |
554 | } |
555 | |
556 | static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev) |
557 | @@ -4000,8 +4009,16 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl) |
558 | return err; |
559 | } |
560 | |
561 | +#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice) ( \ |
562 | + (pdev->vendor == PCI_VENDOR_ID_##_vendor) && \ |
563 | + (pdev->device == _device) && \ |
564 | + (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) && \ |
565 | + (pdev->subsystem_device == _subdevice) ) |
566 | + |
567 | static void b43_sprom_fixup(struct ssb_bus *bus) |
568 | { |
569 | + struct pci_dev *pdev; |
570 | + |
571 | /* boardflags workarounds */ |
572 | if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL && |
573 | bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74) |
574 | @@ -4009,6 +4026,13 @@ static void b43_sprom_fixup(struct ssb_bus *bus) |
575 | if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE && |
576 | bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40) |
577 | bus->sprom.boardflags_lo |= B43_BFL_PACTRL; |
578 | + if (bus->bustype == SSB_BUSTYPE_PCI) { |
579 | + pdev = bus->host_pci; |
580 | + if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) || |
581 | + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) || |
582 | + IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013)) |
583 | + bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST; |
584 | + } |
585 | } |
586 | |
587 | static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl) |
588 | diff --git a/drivers/rtc/rtc-pcf8583.c b/drivers/rtc/rtc-pcf8583.c |
589 | index 8b39970..3d09d8f 100644 |
590 | --- a/drivers/rtc/rtc-pcf8583.c |
591 | +++ b/drivers/rtc/rtc-pcf8583.c |
592 | @@ -15,7 +15,7 @@ |
593 | #include <linux/i2c.h> |
594 | #include <linux/slab.h> |
595 | #include <linux/string.h> |
596 | -#include <linux/mc146818rtc.h> |
597 | +#include <linux/rtc.h> |
598 | #include <linux/init.h> |
599 | #include <linux/errno.h> |
600 | #include <linux/bcd.h> |
601 | diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c |
602 | index 3c1b433..0e8e092 100644 |
603 | --- a/drivers/scsi/qla2xxx/qla_os.c |
604 | +++ b/drivers/scsi/qla2xxx/qla_os.c |
605 | @@ -2357,7 +2357,7 @@ qla2x00_do_dpc(void *data) |
606 | } else { |
607 | fcport->login_retry = 0; |
608 | } |
609 | - if (fcport->login_retry == 0) |
610 | + if (fcport->login_retry == 0 && status != QLA_SUCCESS) |
611 | fcport->loop_id = FC_NO_LOOP_ID; |
612 | } |
613 | if (test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags)) |
614 | diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c |
615 | index 116211f..0dddd68 100644 |
616 | --- a/drivers/serial/dz.c |
617 | +++ b/drivers/serial/dz.c |
618 | @@ -819,7 +819,7 @@ static void dz_console_putchar(struct uart_port *uport, int ch) |
619 | dz_out(dport, DZ_TCR, mask); |
620 | iob(); |
621 | udelay(2); |
622 | - } while (loops--); |
623 | + } while (--loops); |
624 | |
625 | if (loops) /* Cannot send otherwise. */ |
626 | dz_out(dport, DZ_TDR, ch); |
627 | diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c |
628 | index b434df7..274a448 100644 |
629 | --- a/drivers/ssb/pci.c |
630 | +++ b/drivers/ssb/pci.c |
631 | @@ -482,6 +482,11 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out, |
632 | goto unsupported; |
633 | } |
634 | |
635 | + if (out->boardflags_lo == 0xFFFF) |
636 | + out->boardflags_lo = 0; /* per specs */ |
637 | + if (out->boardflags_hi == 0xFFFF) |
638 | + out->boardflags_hi = 0; /* per specs */ |
639 | + |
640 | return 0; |
641 | unsupported: |
642 | ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d " |
643 | diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
644 | index 68fc521..7f1bc97 100644 |
645 | --- a/drivers/usb/core/hub.c |
646 | +++ b/drivers/usb/core/hub.c |
647 | @@ -2664,6 +2664,7 @@ loop: |
648 | if ((status == -ENOTCONN) || (status == -ENOTSUPP)) |
649 | break; |
650 | } |
651 | + dev_err(hub_dev, "unable to enumerate USB device on port %d\n", port1); |
652 | |
653 | done: |
654 | hub_port_disable(hub, port1, 1); |
655 | diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c |
656 | index d0360f6..b0e2275 100644 |
657 | --- a/drivers/usb/host/ohci-pci.c |
658 | +++ b/drivers/usb/host/ohci-pci.c |
659 | @@ -312,11 +312,13 @@ static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message) |
660 | |
661 | static int ohci_pci_resume (struct usb_hcd *hcd) |
662 | { |
663 | + struct ohci_hcd *ohci = hcd_to_ohci(hcd); |
664 | + |
665 | set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); |
666 | |
667 | /* FIXME: we should try to detect loss of VBUS power here */ |
668 | prepare_for_handover(hcd); |
669 | - |
670 | + ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrenable); |
671 | return 0; |
672 | } |
673 | |
674 | diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c |
675 | index ed67881..7b02a4a 100644 |
676 | --- a/drivers/usb/serial/sierra.c |
677 | +++ b/drivers/usb/serial/sierra.c |
678 | @@ -164,6 +164,7 @@ static struct usb_device_id id_table [] = { |
679 | { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 & AC 875U */ |
680 | { USB_DEVICE(0x1199, 0x6813) }, /* Sierra Wireless MC8775 (Thinkpad internal) */ |
681 | { USB_DEVICE(0x1199, 0x6815) }, /* Sierra Wireless MC8775 */ |
682 | + { USB_DEVICE(0x03f0, 0x1e1d) }, /* HP hs2300 a.k.a MC8775 */ |
683 | { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */ |
684 | { USB_DEVICE(0x1199, 0x6832) }, /* Sierra Wireless MC8780*/ |
685 | { USB_DEVICE(0x1199, 0x6833) }, /* Sierra Wireless MC8781*/ |
686 | diff --git a/fs/aio.c b/fs/aio.c |
687 | index 2283686..ae94e1d 100644 |
688 | --- a/fs/aio.c |
689 | +++ b/fs/aio.c |
690 | @@ -1166,7 +1166,10 @@ retry: |
691 | break; |
692 | if (min_nr <= i) |
693 | break; |
694 | - ret = 0; |
695 | + if (unlikely(ctx->dead)) { |
696 | + ret = -EINVAL; |
697 | + break; |
698 | + } |
699 | if (to.timed_out) /* Only check after read evt */ |
700 | break; |
701 | /* Try to only show up in io wait if there are ops |
702 | @@ -1231,6 +1234,13 @@ static void io_destroy(struct kioctx *ioctx) |
703 | |
704 | aio_cancel_all(ioctx); |
705 | wait_for_all_aios(ioctx); |
706 | + |
707 | + /* |
708 | + * Wake up any waiters. The setting of ctx->dead must be seen |
709 | + * by other CPUs at this point. Right now, we rely on the |
710 | + * locking done by the above calls to ensure this consistency. |
711 | + */ |
712 | + wake_up(&ioctx->wait); |
713 | put_ioctx(ioctx); /* once for the lookup */ |
714 | } |
715 | |
716 | diff --git a/fs/dnotify.c b/fs/dnotify.c |
717 | index 28d01ed..eaecc4c 100644 |
718 | --- a/fs/dnotify.c |
719 | +++ b/fs/dnotify.c |
720 | @@ -20,6 +20,7 @@ |
721 | #include <linux/init.h> |
722 | #include <linux/spinlock.h> |
723 | #include <linux/slab.h> |
724 | +#include <linux/file.h> |
725 | |
726 | int dir_notify_enable __read_mostly = 1; |
727 | |
728 | @@ -66,6 +67,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) |
729 | struct dnotify_struct **prev; |
730 | struct inode *inode; |
731 | fl_owner_t id = current->files; |
732 | + struct file *f; |
733 | int error = 0; |
734 | |
735 | if ((arg & ~DN_MULTISHOT) == 0) { |
736 | @@ -92,6 +94,15 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) |
737 | prev = &odn->dn_next; |
738 | } |
739 | |
740 | + rcu_read_lock(); |
741 | + f = fcheck(fd); |
742 | + rcu_read_unlock(); |
743 | + /* we'd lost the race with close(), sod off silently */ |
744 | + /* note that inode->i_lock prevents reordering problems |
745 | + * between accesses to descriptor table and ->i_dnotify */ |
746 | + if (f != filp) |
747 | + goto out_free; |
748 | + |
749 | error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0); |
750 | if (error) |
751 | goto out_free; |
752 | diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c |
753 | index a1db918..4c895f3 100644 |
754 | --- a/fs/jffs2/erase.c |
755 | +++ b/fs/jffs2/erase.c |
756 | @@ -419,9 +419,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb |
757 | if (jffs2_write_nand_cleanmarker(c, jeb)) |
758 | goto filebad; |
759 | } |
760 | - |
761 | - /* Everything else got zeroed before the erase */ |
762 | - jeb->free_size = c->sector_size; |
763 | } else { |
764 | |
765 | struct kvec vecs[1]; |
766 | @@ -449,18 +446,19 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb |
767 | |
768 | goto filebad; |
769 | } |
770 | - |
771 | - /* Everything else got zeroed before the erase */ |
772 | - jeb->free_size = c->sector_size; |
773 | - /* FIXME Special case for cleanmarker in empty block */ |
774 | - jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); |
775 | } |
776 | + /* Everything else got zeroed before the erase */ |
777 | + jeb->free_size = c->sector_size; |
778 | |
779 | down(&c->erase_free_sem); |
780 | spin_lock(&c->erase_completion_lock); |
781 | + |
782 | c->erasing_size -= c->sector_size; |
783 | - c->free_size += jeb->free_size; |
784 | - c->used_size += jeb->used_size; |
785 | + c->free_size += c->sector_size; |
786 | + |
787 | + /* Account for cleanmarker now, if it's in-band */ |
788 | + if (c->cleanmarker_size && !jffs2_cleanmarker_oob(c)) |
789 | + jffs2_link_node_ref(c, jeb, jeb->offset | REF_NORMAL, c->cleanmarker_size, NULL); |
790 | |
791 | jffs2_dbg_acct_sanity_check_nolock(c,jeb); |
792 | jffs2_dbg_acct_paranoia_check_nolock(c, jeb); |
793 | diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h |
794 | index b9e1740..44c81c7 100644 |
795 | --- a/include/linux/rtnetlink.h |
796 | +++ b/include/linux/rtnetlink.h |
797 | @@ -740,13 +740,13 @@ extern void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change); |
798 | extern void rtnl_lock(void); |
799 | extern void rtnl_unlock(void); |
800 | extern int rtnl_trylock(void); |
801 | +extern int rtnl_is_locked(void); |
802 | |
803 | extern void rtnetlink_init(void); |
804 | extern void __rtnl_unlock(void); |
805 | |
806 | #define ASSERT_RTNL() do { \ |
807 | - if (unlikely(rtnl_trylock())) { \ |
808 | - rtnl_unlock(); \ |
809 | + if (unlikely(!rtnl_is_locked())) { \ |
810 | printk(KERN_ERR "RTNL: assertion failed at %s (%d)\n", \ |
811 | __FILE__, __LINE__); \ |
812 | dump_stack(); \ |
813 | diff --git a/include/net/tcp.h b/include/net/tcp.h |
814 | index 4fd3eb2..d69d12e 100644 |
815 | --- a/include/net/tcp.h |
816 | +++ b/include/net/tcp.h |
817 | @@ -776,11 +776,14 @@ extern void tcp_enter_cwr(struct sock *sk, const int set_ssthresh); |
818 | extern __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst); |
819 | |
820 | /* Slow start with delack produces 3 packets of burst, so that |
821 | - * it is safe "de facto". |
822 | + * it is safe "de facto". This will be the default - same as |
823 | + * the default reordering threshold - but if reordering increases, |
824 | + * we must be able to allow cwnd to burst at least this much in order |
825 | + * to not pull it back when holes are filled. |
826 | */ |
827 | static __inline__ __u32 tcp_max_burst(const struct tcp_sock *tp) |
828 | { |
829 | - return 3; |
830 | + return tp->reordering; |
831 | } |
832 | |
833 | /* Returns end sequence number of the receiver's advertised window */ |
834 | diff --git a/include/net/xfrm.h b/include/net/xfrm.h |
835 | index 0d255ae..97577de 100644 |
836 | --- a/include/net/xfrm.h |
837 | +++ b/include/net/xfrm.h |
838 | @@ -435,6 +435,9 @@ struct xfrm_tmpl |
839 | /* May skip this transfomration if no SA is found */ |
840 | __u8 optional; |
841 | |
842 | +/* Skip aalgos/ealgos/calgos checks. */ |
843 | + __u8 allalgs; |
844 | + |
845 | /* Bit mask of algos allowed for acquisition */ |
846 | __u32 aalgos; |
847 | __u32 ealgos; |
848 | diff --git a/kernel/cgroup.c b/kernel/cgroup.c |
849 | index 2727f92..6d8de05 100644 |
850 | --- a/kernel/cgroup.c |
851 | +++ b/kernel/cgroup.c |
852 | @@ -1722,7 +1722,12 @@ void cgroup_enable_task_cg_lists(void) |
853 | use_task_css_set_links = 1; |
854 | do_each_thread(g, p) { |
855 | task_lock(p); |
856 | - if (list_empty(&p->cg_list)) |
857 | + /* |
858 | + * We should check if the process is exiting, otherwise |
859 | + * it will race with cgroup_exit() in that the list |
860 | + * entry won't be deleted though the process has exited. |
861 | + */ |
862 | + if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list)) |
863 | list_add(&p->cg_list, &p->cgroups->tasks); |
864 | task_unlock(p); |
865 | } while_each_thread(g, p); |
866 | diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c |
867 | index 98bee01..c15a359 100644 |
868 | --- a/kernel/hrtimer.c |
869 | +++ b/kernel/hrtimer.c |
870 | @@ -590,7 +590,6 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer, |
871 | list_add_tail(&timer->cb_entry, |
872 | &base->cpu_base->cb_pending); |
873 | timer->state = HRTIMER_STATE_PENDING; |
874 | - raise_softirq(HRTIMER_SOFTIRQ); |
875 | return 1; |
876 | default: |
877 | BUG(); |
878 | @@ -633,6 +632,11 @@ static int hrtimer_switch_to_hres(void) |
879 | return 1; |
880 | } |
881 | |
882 | +static inline void hrtimer_raise_softirq(void) |
883 | +{ |
884 | + raise_softirq(HRTIMER_SOFTIRQ); |
885 | +} |
886 | + |
887 | #else |
888 | |
889 | static inline int hrtimer_hres_active(void) { return 0; } |
890 | @@ -651,6 +655,7 @@ static inline int hrtimer_reprogram(struct hrtimer *timer, |
891 | { |
892 | return 0; |
893 | } |
894 | +static inline void hrtimer_raise_softirq(void) { } |
895 | |
896 | #endif /* CONFIG_HIGH_RES_TIMERS */ |
897 | |
898 | @@ -850,7 +855,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode) |
899 | { |
900 | struct hrtimer_clock_base *base, *new_base; |
901 | unsigned long flags; |
902 | - int ret; |
903 | + int ret, raise; |
904 | |
905 | base = lock_hrtimer_base(timer, &flags); |
906 | |
907 | @@ -884,8 +889,18 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode) |
908 | enqueue_hrtimer(timer, new_base, |
909 | new_base->cpu_base == &__get_cpu_var(hrtimer_bases)); |
910 | |
911 | + /* |
912 | + * The timer may be expired and moved to the cb_pending |
913 | + * list. We can not raise the softirq with base lock held due |
914 | + * to a possible deadlock with runqueue lock. |
915 | + */ |
916 | + raise = timer->state == HRTIMER_STATE_PENDING; |
917 | + |
918 | unlock_hrtimer_base(timer, &flags); |
919 | |
920 | + if (raise) |
921 | + hrtimer_raise_softirq(); |
922 | + |
923 | return ret; |
924 | } |
925 | EXPORT_SYMBOL_GPL(hrtimer_start); |
926 | @@ -1080,8 +1095,19 @@ static void run_hrtimer_pending(struct hrtimer_cpu_base *cpu_base) |
927 | * If the timer was rearmed on another CPU, reprogram |
928 | * the event device. |
929 | */ |
930 | - if (timer->base->first == &timer->node) |
931 | - hrtimer_reprogram(timer, timer->base); |
932 | + struct hrtimer_clock_base *base = timer->base; |
933 | + |
934 | + if (base->first == &timer->node && |
935 | + hrtimer_reprogram(timer, base)) { |
936 | + /* |
937 | + * Timer is expired. Thus move it from tree to |
938 | + * pending list again. |
939 | + */ |
940 | + __remove_hrtimer(timer, base, |
941 | + HRTIMER_STATE_PENDING, 0); |
942 | + list_add_tail(&timer->cb_entry, |
943 | + &base->cpu_base->cb_pending); |
944 | + } |
945 | } |
946 | } |
947 | spin_unlock_irq(&cpu_base->lock); |
948 | diff --git a/mm/pagewalk.c b/mm/pagewalk.c |
949 | index 1cf1417..0afd238 100644 |
950 | --- a/mm/pagewalk.c |
951 | +++ b/mm/pagewalk.c |
952 | @@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, |
953 | int err = 0; |
954 | |
955 | pte = pte_offset_map(pmd, addr); |
956 | - do { |
957 | + for (;;) { |
958 | err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private); |
959 | if (err) |
960 | break; |
961 | - } while (pte++, addr += PAGE_SIZE, addr != end); |
962 | + addr += PAGE_SIZE; |
963 | + if (addr == end) |
964 | + break; |
965 | + pte++; |
966 | + } |
967 | |
968 | pte_unmap(pte); |
969 | return err; |
970 | diff --git a/net/can/raw.c b/net/can/raw.c |
971 | index 94cd7f2..c92cb8e 100644 |
972 | --- a/net/can/raw.c |
973 | +++ b/net/can/raw.c |
974 | @@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname, |
975 | int fsize = ro->count * sizeof(struct can_filter); |
976 | if (len > fsize) |
977 | len = fsize; |
978 | - err = copy_to_user(optval, ro->filter, len); |
979 | + if (copy_to_user(optval, ro->filter, len)) |
980 | + err = -EFAULT; |
981 | } else |
982 | len = 0; |
983 | release_sock(sk); |
984 | diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
985 | index 2bd9c5f..0cb2772 100644 |
986 | --- a/net/core/rtnetlink.c |
987 | +++ b/net/core/rtnetlink.c |
988 | @@ -82,6 +82,11 @@ int rtnl_trylock(void) |
989 | return mutex_trylock(&rtnl_mutex); |
990 | } |
991 | |
992 | +int rtnl_is_locked(void) |
993 | +{ |
994 | + return mutex_is_locked(&rtnl_mutex); |
995 | +} |
996 | + |
997 | static struct rtnl_link *rtnl_msg_handlers[NPROTO]; |
998 | |
999 | static inline int rtm_msgindex(int msgtype) |
1000 | @@ -1389,6 +1394,7 @@ EXPORT_SYMBOL(rtnetlink_put_metrics); |
1001 | EXPORT_SYMBOL(rtnl_lock); |
1002 | EXPORT_SYMBOL(rtnl_trylock); |
1003 | EXPORT_SYMBOL(rtnl_unlock); |
1004 | +EXPORT_SYMBOL(rtnl_is_locked); |
1005 | EXPORT_SYMBOL(rtnl_unicast); |
1006 | EXPORT_SYMBOL(rtnl_notify); |
1007 | EXPORT_SYMBOL(rtnl_set_sk_err); |
1008 | diff --git a/net/dccp/probe.c b/net/dccp/probe.c |
1009 | index 7053bb8..44eddcf 100644 |
1010 | --- a/net/dccp/probe.c |
1011 | +++ b/net/dccp/probe.c |
1012 | @@ -145,7 +145,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf, |
1013 | goto out_free; |
1014 | |
1015 | cnt = kfifo_get(dccpw.fifo, tbuf, len); |
1016 | - error = copy_to_user(buf, tbuf, cnt); |
1017 | + error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0; |
1018 | |
1019 | out_free: |
1020 | vfree(tbuf); |
1021 | diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c |
1022 | index 87dd5bf..a79a547 100644 |
1023 | --- a/net/ipv4/tcp_probe.c |
1024 | +++ b/net/ipv4/tcp_probe.c |
1025 | @@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf, |
1026 | |
1027 | width = tcpprobe_sprint(tbuf, sizeof(tbuf)); |
1028 | |
1029 | - if (width < len) |
1030 | + if (cnt + width < len) |
1031 | tcp_probe.tail = (tcp_probe.tail + 1) % bufsize; |
1032 | |
1033 | spin_unlock_bh(&tcp_probe.lock); |
1034 | |
1035 | /* if record greater than space available |
1036 | return partial buffer (so far) */ |
1037 | - if (width >= len) |
1038 | + if (cnt + width >= len) |
1039 | break; |
1040 | |
1041 | - error = copy_to_user(buf + cnt, tbuf, width); |
1042 | - if (error) |
1043 | - break; |
1044 | + if (copy_to_user(buf + cnt, tbuf, width)) |
1045 | + return -EFAULT; |
1046 | cnt += width; |
1047 | } |
1048 | |
1049 | diff --git a/net/key/af_key.c b/net/key/af_key.c |
1050 | index e9ef9af..5ceab25 100644 |
1051 | --- a/net/key/af_key.c |
1052 | +++ b/net/key/af_key.c |
1053 | @@ -1856,7 +1856,7 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) |
1054 | t->encap_family = xp->family; |
1055 | |
1056 | /* No way to set this via kame pfkey */ |
1057 | - t->aalgos = t->ealgos = t->calgos = ~0; |
1058 | + t->allalgs = 1; |
1059 | xp->xfrm_nr++; |
1060 | return 0; |
1061 | } |
1062 | diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c |
1063 | index 063cbc5..f9293c7 100644 |
1064 | --- a/net/rose/af_rose.c |
1065 | +++ b/net/rose/af_rose.c |
1066 | @@ -760,8 +760,10 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le |
1067 | |
1068 | rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, |
1069 | &diagnostic); |
1070 | - if (!rose->neighbour) |
1071 | - return -ENETUNREACH; |
1072 | + if (!rose->neighbour) { |
1073 | + err = -ENETUNREACH; |
1074 | + goto out_release; |
1075 | + } |
1076 | |
1077 | rose->lci = rose_new_lci(rose->neighbour); |
1078 | if (!rose->lci) { |
1079 | diff --git a/net/tipc/socket.c b/net/tipc/socket.c |
1080 | index 2290903..ac04733 100644 |
1081 | --- a/net/tipc/socket.c |
1082 | +++ b/net/tipc/socket.c |
1083 | @@ -1600,8 +1600,8 @@ static int getsockopt(struct socket *sock, |
1084 | else if (len < sizeof(value)) { |
1085 | res = -EINVAL; |
1086 | } |
1087 | - else if ((res = copy_to_user(ov, &value, sizeof(value)))) { |
1088 | - /* couldn't return value */ |
1089 | + else if (copy_to_user(ov, &value, sizeof(value))) { |
1090 | + res = -EFAULT; |
1091 | } |
1092 | else { |
1093 | res = put_user(sizeof(value), ol); |
1094 | diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c |
1095 | index 9fc4c31..c44076c 100644 |
1096 | --- a/net/xfrm/xfrm_policy.c |
1097 | +++ b/net/xfrm/xfrm_policy.c |
1098 | @@ -1772,7 +1772,7 @@ xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x, |
1099 | (x->id.spi == tmpl->id.spi || !tmpl->id.spi) && |
1100 | (x->props.reqid == tmpl->reqid || !tmpl->reqid) && |
1101 | x->props.mode == tmpl->mode && |
1102 | - ((tmpl->aalgos & (1<<x->props.aalgo)) || |
1103 | + (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) || |
1104 | !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) && |
1105 | !(x->props.mode != XFRM_MODE_TRANSPORT && |
1106 | xfrm_state_addr_cmp(tmpl, x, family)); |
1107 | diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c |
1108 | index 019d21d..12f19be 100644 |
1109 | --- a/net/xfrm/xfrm_user.c |
1110 | +++ b/net/xfrm/xfrm_user.c |
1111 | @@ -975,6 +975,8 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut, |
1112 | t->aalgos = ut->aalgos; |
1113 | t->ealgos = ut->ealgos; |
1114 | t->calgos = ut->calgos; |
1115 | + /* If all masks are ~0, then we allow all algorithms. */ |
1116 | + t->allalgs = !~(t->aalgos & t->ealgos & t->calgos); |
1117 | t->encap_family = ut->family; |
1118 | } |
1119 | } |
1120 | diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c |
1121 | index d39b59c..f4fa982 100644 |
1122 | --- a/security/selinux/hooks.c |
1123 | +++ b/security/selinux/hooks.c |
1124 | @@ -756,9 +756,18 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb, |
1125 | int set_context = (oldsbsec->flags & CONTEXT_MNT); |
1126 | int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT); |
1127 | |
1128 | - /* we can't error, we can't save the info, this shouldn't get called |
1129 | - * this early in the boot process. */ |
1130 | - BUG_ON(!ss_initialized); |
1131 | + /* |
1132 | + * if the parent was able to be mounted it clearly had no special lsm |
1133 | + * mount options. thus we can safely put this sb on the list and deal |
1134 | + * with it later |
1135 | + */ |
1136 | + if (!ss_initialized) { |
1137 | + spin_lock(&sb_security_lock); |
1138 | + if (list_empty(&newsbsec->list)) |
1139 | + list_add(&newsbsec->list, &superblock_security_head); |
1140 | + spin_unlock(&sb_security_lock); |
1141 | + return; |
1142 | + } |
1143 | |
1144 | /* how can we clone if the old one wasn't set up?? */ |
1145 | BUG_ON(!oldsbsec->initialized); |